/home/ghozt — reverse engineering, malware analysis & binary exploitation blog

TL;DR

Static analysis of a Rust crypter/loader:

• Embedded x64 DLL split into ~200 fragments interleaved between .rdata and .data, PE headers stored apart with MZ / PE\0\0 wiped
• base64url with a shuffled alphabet (Fisher-Yates + splitmix64) and a junk char every 57
• splitmix-looking XOR keystream with non-standard constants I couldn’t find documented anywhere
• Custom bit-level LZ container
• Control-flow flattening + opaque predicates fed by TLS values, which Ghidra just gives up on

Read More

TL;DR

Stripped binaries still leak their source metadata, and you can recover it:

• Logging and assert/BUG() macros bake __FILE__, __LINE__ and __func__ straight into .rodata
• Those string literals hand back original function names and the source directory tree
• Two Binary Ninja plugins automate it: logrn (renames functions) and arborist (rebuilds the tree)
• Walkthrough on a tiny example first, then the automation

Read More

TL;DR

Analysis of an Android dropper distributed as a fake VPN app

• Multi stage malware
• Use of obfuscation techniques
• Full static analysis (because I <3 it)

Part of my malware analysis series: see also a PowerShell dropper to Amatera and a StealC infostealer.

Read More

TL;DR

In-depth analysis of a Powershell dropper:

• 5 stages malware - from an ASCII-encoded PowerShell dropper down to a custom C2 implant phoning home to a hardcoded IP
• Obfuscated Powershell scripts with opaq predicats
• Custom API hashing, aPLib, rolling XOR
• C2 Beacon with SNI spoofing, json+zip exfiltration, encoded endpoints - Amatera like

More malware write-ups in the same vein: StealC infostealer and GLOBAL GROUP ransomware.

Read More

Analysis Date: January 7, 2026
Methodology: Static analysis only
Sample: f6f7a37b49310287a253dbdf81e22f0593f44111215ca9308e46d2c68516196f

---

TL;DR

In-depth analysis of GLOBAL GROUP ransomware (RaaS), revealing:

• An encrypted .config section using a custom XOR + LCG algorithm
• Hybrid encryption: Curve25519 (ECDH) + SHA-512 (KDF) + HC-128 (stream cipher)
• The “hash” at config offset 0x843 is actually the builder’s Curve25519 public key
• Three encryption modes based on file size (including a “panic” mode)
• Per-file ephemeral keys with proper asymmetric cryptography
• A builder structure allowing per-victim custom configs

Read More

TL;DR

Static analysis of a StealC infostealer that uses the Heaven’s Gate technique to transition from 32-bit to 64-bit mode, trying to bypass EDR hooks. Features RC4-encrypted config strings, a custom “MZER” payload marker, and direct syscalls. Successfully extracted the C2 server, decryption key, and 150+ encrypted strings without dynamic execution. Full IOCs at the bottom for anyone who just wants the indicators.

Related static-only deep dives: GLOBAL GROUP ransomware and reversing a random stealer.

---

Read More

TL;DR

Reversing a randomly-picked MalShare sample that turned out to be an ambitious .NET stealer:

• Credential and Discord token theft, encrypted strings and an embedded payload
• Static analysis with Binary Ninja: AMSI bypass, resource loading and payload decryption
• From a blind, random download all the way to full behaviour, step by step

Read More

TL;DR

A beginner-friendly walkthrough of coverage-guided fuzzing with AFL:

• Install and build AFL (American Fuzzy Lop) from source
• Instrument and compile a small open-source C program for fuzzing
• Run AFL, read its status screen and collect the first crashes

Read More

TL;DR

Reversing a Rust string-obfuscation macro and automating the decryption:

• Reversing litcrypt, a Rust proc-macro that XOR-obfuscates strings at compile time
• Locating the encrypted strings and the runtime decryption routine in the compiled binary
• Building a Binary Ninja plugin (and learning the API) to recover the plaintext automatically
• A methodology-first write-up: the real reversing process, dead-ends included

Read More